CVE-2025-49642: Zabbix Agent AIX Privilege Escalation

CVE-2025-49642 Overview

CVE-2025-49642 is a library hijacking vulnerability affecting Zabbix Agent builds on AIX systems. The vulnerability allows local users with write access to the /home/cecuser directory to hijack library loading, potentially leading to privilege escalation or arbitrary code execution within the context of the Zabbix Agent process.

This vulnerability is classified as CWE-426 (Untrusted Search Path), which occurs when an application searches for libraries or executables in directories that are writable by unprivileged users. An attacker can place a malicious library in the trusted search path, which will be loaded instead of the legitimate library.

Critical Impact

Local attackers with write access to /home/cecuser can hijack library loading to execute arbitrary code with Zabbix Agent privileges, potentially compromising monitoring infrastructure and pivoting to monitored systems.

Affected Products

• Zabbix Agent builds on AIX systems
• Systems with writable /home/cecuser directory accessible to local users

Discovery Timeline

• December 1, 2025 - CVE-2025-49642 published to NVD
• December 1, 2025 - Last updated in NVD database

Technical Details for CVE-2025-49642

Vulnerability Analysis

The vulnerability exists in how Zabbix Agent builds on AIX systems handle library loading. The agent searches for required libraries in paths that include the /home/cecuser directory, which may be writable by local users. This creates an untrusted search path condition where malicious libraries can be injected.

The CVSS 4.0 vector string is CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X with a base score of 5.8 (MEDIUM). The attack requires local access with low privileges and has high impact on integrity and availability.

The Exploit Prediction Scoring System (EPSS) indicates a 0.016% probability of exploitation, placing this vulnerability in the 2.73rd percentile. While exploitation probability is low, the potential impact on monitoring infrastructure makes this a significant concern.

Root Cause

The root cause of this vulnerability is improper configuration of the library search path (LIBPATH on AIX) in Zabbix Agent builds. When the agent is compiled or deployed, it includes /home/cecuser in its library search path. This directory, typically used for build or deployment purposes, may have overly permissive write permissions that allow local users to place malicious shared libraries.

On AIX systems, the LIBPATH environment variable and compiled-in library paths determine where the dynamic linker searches for shared libraries. If an attacker can place a library with the same name as a legitimate dependency in a location that appears earlier in the search path, the malicious library will be loaded instead.

Attack Vector

The attack vector is local, requiring an attacker to have shell access to the affected system and write permissions to the /home/cecuser directory. The attack chain typically involves:

1. The attacker identifies the Zabbix Agent's library dependencies using tools like ldd or by examining the binary
2. The attacker creates a malicious shared library with the same name as a legitimate dependency
3. The malicious library is placed in /home/cecuser which is included in the library search path
4. When the Zabbix Agent starts or reloads, it loads the malicious library
5. Code within the malicious library executes with the privileges of the Zabbix Agent process

The vulnerability requires local access (AV:L), low attack complexity (AC:L), and low privileges (PR:L). No user interaction is required (UI:N), but the attack has prerequisites (AT:P) related to write access to the specific directory.

Detection Methods for CVE-2025-49642

Indicators of Compromise

• Unauthorized files or libraries appearing in /home/cecuser directory
• Modified library files with unexpected timestamps or permissions
• Unusual process behavior from zabbix_agentd including unexpected network connections or child processes
• File system monitoring alerts for write operations to library directories
• Unexpected library dependencies in Zabbix Agent process memory maps

Detection Strategies

Security teams should implement file integrity monitoring on the /home/cecuser directory and any other directories in the Zabbix Agent's library search path. Monitor for the creation of new shared library files (.so, .a files on AIX) in these locations.

Process monitoring should track library loading events for Zabbix Agent processes. On AIX, the procfiles command can be used to examine open file descriptors and loaded libraries for running processes. Any unexpected libraries should be investigated immediately.

SentinelOne Singularity platform provides behavioral detection capabilities that can identify suspicious library loading patterns, including libraries loaded from user-writable directories. The platform's deep visibility into process execution and library dependencies enables detection of library hijacking attempts before malicious code can execute.

Monitoring Recommendations

Configure audit rules to monitor file creation and modification events in the /home/cecuser directory. On AIX systems, use the audit subsystem to track file system operations. Additionally, monitor the Zabbix Agent process for unexpected behavior such as spawning child processes, establishing network connections to unknown hosts, or accessing sensitive files.

Implement regular security scans that verify the integrity of Zabbix Agent installations and compare loaded libraries against known-good baselines. Consider deploying endpoint detection and response (EDR) solutions that can detect and prevent library hijacking attacks in real-time.

How to Mitigate CVE-2025-49642

Immediate Actions Required

• Review and restrict write permissions on the /home/cecuser directory to authorized users only
• Audit current permissions: ls -la /home/cecuser and ensure only root or the Zabbix service account has write access
• Verify the integrity of existing libraries in the Zabbix Agent search path
• Consider running Zabbix Agent in a chroot environment or container to limit library search paths
• Monitor for any signs of exploitation using file integrity monitoring tools

Patch Information

Refer to the official Zabbix security advisory at https://support.zabbix.com/browse/ZBX-27283 for the latest patch information and updated builds that address this vulnerability. Organizations should apply vendor-provided patches as soon as they become available.

When patches are applied, verify that the library search path has been corrected and no longer includes user-writable directories. Test the updated agent in a staging environment before deploying to production monitoring infrastructure.

Workarounds

If immediate patching is not possible, administrators can implement the following workarounds to reduce risk:

Restrict directory permissions to prevent unauthorized users from writing to /home/cecuser:

# Restrict write access to /home/cecuser directory
chmod 755 /home/cecuser
chown root:system /home/cecuser

# Verify Zabbix Agent library path (AIX)
ldd /usr/local/sbin/zabbix_agentd

# Set restricted LIBPATH before starting agent
export LIBPATH=/usr/lib:/lib

Additionally, consider implementing mandatory access controls (MAC) using AIX Trusted Computing Base (TCB) features to further restrict which libraries can be loaded by the Zabbix Agent process. Network segmentation should also be employed to limit the impact of potential compromise of monitoring infrastructure.